Bugzilla – Bug 293
Segmentation fault with nonexistant uid
Last modified: 2008-11-05 20:04:15 MST
Discovered on 1.6.9p10, tested on 1.6.9p17 - specifying a uid with -u #num causes a segmentation fault when the specified uid does not exist: $ sudo -u \#-1 -i Segmentation fault I'm not sure under exactly which contexts the bug is triggered, but I can't reproduce it with the patch I'm about to attach applied.
Created attachment 225 [details] abort on uid not found Sorry, I didn't realise when filing the bug that I could make attachments on the first post.
Created attachment 226 [details] Avoid following NULL pointer in -i mode This only affects the -i flag so there's no need to remove support for running commands as arbitrary uids. The attached patch will detect the non-existent shell and error out appropriately.
On my machine I get a segmentation fault on this too: ben@euler:~/software/sudo-1.6.9p17$ ./sudo -u \#-1 pwd Segmentation fault The gdb backtrace is identical, and the patch I attached still fixed the issue. Not everywhere I tested DOES segfault with this command or a similar one (although they do with -i), but on the only other machine I could try this, a debug build from the latest source had the issue while the builtin sudo (version 1.6.9p12) did not.
As I am unable to reproduce the problem could you please attach the gdb backtrace?
Created attachment 227 [details] Fill in more passwd data when running as a non-existent uid Perhaps this will work better.
Created attachment 228 [details] backtrace Your newest patch fixes the issue (even with -i, which is pretty useful, thanks!) as far as I can tell, but I attached the backtrace you asked for anyway just in case. I'd suggest that it might be wise to print a warning, at least, when the UID given doesn't match any existing user and so we are using 'fabricated' details.